Recently, there has been a move toward virtualization of certain types of network functionality. In some of these virtualization approaches, common off the shelf (“COTS”) hardware can be used to host virtual machines that can execute software to provide functionality associated with certain applications or services. Thus, specialized hardware and software can be replaced by generic hardware that can execute specialized software modules.
In some instances, traffic associated with virtualized services may be important for analysis and/or network security purposes, among other purposes. To capture data associated with the traffic, a probe can be created to capture all traffic that passes through a physical interface of the COTS hardware (e.g., a server), or any data that leaves or arrives at a data center may be captured. In either of these approaches, some of the data captured may or may not be useful to analysts for various reasons.